MEMORANDUM OF UNDERSTANDING and 
DATA SHARING AGREEMENT 
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This Memorandum of Understanding and Data Sharing Agreement ("MOU") is entered into on August 8, 
2017 by and between Eckerd Youth Alternatives, Inc. d/b/a Eckerd Kids {"Eckerd Kids' 1 ), a Florida 
nonprofit corporation, Mindshare Consulting Group, LLC ('Mindshare") a Florida not-for-profit 
organization, and the New Hampshire Department of Health and Human Services, Division for Children, 
Youth and Families ("DCYF") with respect to the implementation and use of Fckerd Rapid Safety 
Feedback*. Eckerd Kids and Mindshare are sometimes referred to herein collectively as the "Providers". 
Eckerd Kids, Mindshare and DCYF are sometimes referred to herein collectively as the "Parties. 41 

1. Intent This MOU identifies the Parties' understandings of their rights and obligations to 
each other with respect to 1) the access to and sharing of DCYF Agency data and 2) the 
implementation and use of Eckerd Rapid Safety Feedback*. 

2. Purpose of Agreement. Providers represent that the data specified in this MOU will be used 
solely for purposes of Eckerd Kids Rapid Safety Feedback *. 

3. Definitions: 

1. Agency means the New Hampshire Department of Health and Human Services, 
Division for Children, Youth and Families ("DCYF"). 

2. Confidential Information means information each party may come into contact 
with concerning the other party. Including without limitation client records and 
other proprietary information which must remain confidential pursuant to the 
terms of this MOU. 

3. Eckerd Rapid Safety Feedback 9 means a program developed by Eckerd Kids that 
utilizes predictive analytics to help identify child welfare cases of the highest 
probability of a serious injury or death and identifying critical case practices, 
that when performed by the Agency to applicable standards, will greatly assist 
in keeping the child safe. 

4. Eckerd Rapid Safety Feedback 9 Community of Practice means the Agency 
participating in quarterly fidelity reviews and sharing information and reports 
with Eckerd Kids. 

5. Fidelity Reviews means a review by Providers to ensure the Agency is 
implementing Eckerd Rapid Safety Feedback* according to established 
practices. 

6. CCWtS/SACWIS means the jurisdiction's statewide automated child welfare 
information system referred to as Bridges. 

7. Portal means a website and related technology that is designed to read 
CCWIS/5ACWIS information, perform automated analysis, and generate reports 
that can be used to implement and support Eckerd Rapid Safety Feedback* 
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8* Portal Terms means the website usage terms available on the Portal that sets 
forth the terms and conditions under which the Agency may use the Portal. An 
example of the current portal terms and conditions are Included here as Exhibit 
A. Exhibit A is NOT incorporated herein, but provided for information, only. The 
ruling website usage terms are those that are required to be accepted by the 
User at the time of Portal use. 

9. QA means Agency Quality Assurance staff member that does not carry a 
caseload. 

4* Introduction 

1. Eckerd Kids is a not for profit corporation that specializes in human services, 
specifically child welfare. During the course of its business, Eckerd Kids has 
developed Eckerd Rapid Safety Feedback", a program that has been successful 
in reducing the occurrence of serious injury or death in high risk dependency 
cases. 

2. Eckerd Kids, and its affiliate, Mindshare operate using the Portal and related 
training materials to assist agencies that desire to implement Eckerd Kids Rapid 
Safety Feedback *. 

3. Agency has chosen Eckerd Kids and its affiliate Mindshare to implement Eckerd 
Rapid Safety Feedback" in the State of New Hampshire and this MOU describes 
the responsibilities of the Providers and the Agency in connection with that 
implementation. 

5. Eckerd Kid's Responsibilities 

1. Eckerd Kids, with its affiliate, Mindshare, host, maintain and support the Web 
Portal with a goal of providing the Agency with 24 hour technical support and 
access to the Portal and the reports it generates. At no time will any Web Portal 
content or data be backed up, stored or hosted in any location outside of the 
United States. All data, associated in anyway with the Web Portal will be owned 
solely by the Agency. Mindshare will not authorize or provide access credentials 
to any person other than Agency or Eckerd Kids employees who have a need for 
such access or credentials, without Agency's prior written consent. Mindshare 
will not provide administrative level access to the Web Portal or any database or 
data storage system used by the Web Portal to any person without Agency's 
prior written consent. Each employee of Mindshare who has access to the Web 
Portal or any database or data storage system used by the Web Portal will 
execute a confidentiality agreement reasonably acceptable to the Agency 
confirming the employee's duty to maintain all data and Information relating to 
cases referenced in the Web Portal strictly confidential. Eckerd Kids and 
Mindshare will adhere to the "DHH5 Information Security Requirements" which 
are attached to this agreement as Exhibit B and incorporated herein by 
reference. 

2. Eckerd Kids, with Its affiliate, Mindshare, will: 

a. Adapt the Portal to create reports that provide a customized predictive 
data sample of prioritized cases for review; 
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b. Provide training on review completion, portal entry, staffing techniques, 
and action Item tracking to support the Agency's implementation of 
Eckerd Rapid Safety Feedback 0 ; 

c. Provide Agency personnel with access to the Eckerd Rapid Safety 
Feedback 0 practice guide for use in connection with the Agency's 
Implementation and offer same day technical assistance from case 
review staff experienced in the review process; 

d. Perform quarterly fidelity reviews and coordinate sharing of best 
practices across jurisdictions through the Eckerd Rapid Safety 
Feedback 0 Community of Practice; and, 

e. Provide additional reports as mutually agreed upon by Eckerd Kids and 
the Agency. 

6, Agency's Responsibilities 

1. The Agency will allow the Providers to access an extract of the Agency's 
CCWIS/SACWIS system on a daily basis. The agency will provide access to the 
client fries of clients that died due to maltreatment and/or clients that 
experienced serious maltreatment while known to DCYF. 

2, The Agency will: 

a. Work with Mindshare to establish an agreed exchange protocol and 
accommodate the DCYF data exchange method and data packaging 
formats. The exchange protocol will Include the specifications for the 
Initial historical data package. A minimum of three years client data 
history should be provided within thirty days of signing the MOU; 

b. Provide sufficient reviewers to the Eckerd Rapid Safety Feedback* 
program. Reviewers should be dedicated QA staff that are NOT 
investigating or managing the case or providing supervision to the front 
line workers assigned to the case. Reviewers must successfully complete 
Eckerd Rapid Safety Feedback 0 training (provided at no cost to the 
Agency) prior to completing case reviews; 

c. Participate in a quarterly Fidelity Review, sharing lessons learned with 
other jurisdictions, and report the results observed after 
implementation of Eckerd Rapid Safety Feedback 0 ; 

d. Enter all case reviews into the Eckerd Rapid Safety Feedback 0 portal to 
provide automated tracking functionality, dashboards, and data for the 
continuous Improvement of existing predictive data sets for the Eckerd 
Rapid Safety Feedback* implementation in New Hampshire; and, 

e. Provide Providers written notice of any lawsuit or claim filed or asserted 
against the Agency alleging liability In connection with Eckerd Rapid 
Safety Feedback* 

7, Term of MOU 

1. This MOU will be effective upon execution by the parties and will terminate on 
December 31, 2018 (the 'Term") unless terminated earlier pursuant to Section 
7.2 below. 
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2. Any party may terminate this MOU for any reason with ten (10) calendar day 
written notice to the other parties. 

3. There are no renewals to this MOU. The Parties may, however, negotiate a 
contract to continue Eckerd Rapid Safety Feedback® as mutually agreed upon. 

4. If mutually agreed to by the Parties, his MOU may be extended for up to six (6) 
months to accommodate the negotiation of a contract to continue ERSF*. 

8. Compensation 

Compensation for Eckerd and Mindshare's services under this agreement will be 
provided by Casey Family Programs pursuant to an agreement between Casey 
Family Programs and the Department of Health and Human Services, Division 
for Children Youth and Families dated May 30, 2017, the terms of which are 
incorporated herein by reference. 

9. Intellectual Property 

1. All CCWIS/SACWIS data will be deemed and treated as Confidential Information 
of the Agency. All Intellectual property rights In and to the CCWIS/SACWIS data 
will remain the sole property of the Agency. By making CCWIS/SACWIS data 
available to Providers, the Agency will grant, and hereby does grant, to 
Providers a limited, non-exclusive, royalty-free, fully-pald-up license for the 
term of this MOU to use the CCWIS/SACWIS data, but solely for the purpose of 
implementing Eckerd Rapid Safety Feedback 1 for the Agency, providing the 
Portal and related reports, and Improving Eckerd Rapid Safety Feedback*. 

2. All intellectual property rights in and to Eckerd Kids Rapid Safety Feedback •, 
the Portal and its related software and documentation, the reports generated 
by the Portal, the Eckerd Kids Rapid Safety Feedback * training materials, the 
Eckerd Kids Rapid Safety Feedback * safety guide (including without limitation 
for ali of the foregoing, all related inventions, processes, improvements, trade 
secrets, algorithms, works of authorship, trademarks and service marks (jointly 
"Pre-existing IP") is and will remain the sole property of the original owner 
(Eckerd Kids, its affiliate, Mindshare, and their licensors). All pre-existing IP will 
be deemed and treated as Confidential Informallon. Eckerd Kids and Mindshare 
will grant, and hereby does grant to the Agency, a limited, non-exclusive, 
royalty-free, fully-paid-up license for the term of this MOU to use their pre¬ 
existing IP, but solely for the purpose of implementing Eckerd Kids Rapid Safety 
Feedback ■ for the Agency and subject to this MOU and the Portal Terms. 

3. By using the Portal, Agency is agreeing to abide by, and to be bound by, the 
Portal Terms and any applicable laws (Including, without limitation laws relating 
to privacy and personal identifying information relating to children). 

10. Background checks and verification 

At the sole discretion of the Agency, Providers may be subject to user 
background checks, depending on the information systems Providers accesses 
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or types of data Agency provides. Providers must submit the required 
background check information to the agency in a timely manner, if requested. 

11. 

HIPAA 

Providers agree to use and disclose Protected Health Information in compliance 
with the Standards for Privacy of Individually Identifiable Health information 
(Privacy Rule) (45 CF.R. Parts 160 and 164) under the Health Insurance Portability 
and Accountability Act (HIPAA) of 1996 and In accordance with the Business 

Associates Agreement which has been executed by the parties. Is attached to this 
agreement as Exhibit C and incorporated herein by reference. The definitions set 
forth in the Privacy Rule (45 CF.R 160.103 and 164.501) are Incorporated by 
reference Into this agreement. 

12. 

Governing Law, Venue, and Jurisdiction 


This MOU will be governed by and construed in accordance with the laws of the 

State of New Hampshire, excluding any conflicts of laws, rule, or principle that 
might refer the governance or construction of this MOD to the law of another 
jurisdiction. The Parties agree that all disputes, claims, actions, or lawsuits 
between them, arising out of or relating to this MOU, or for alleged breach of this 

MOU, will be heard and determined by a Superior Court of the State of New 

Hampshire, or by any appellate courts which review decisions of those courts. 

13. 

Entire Agreement 


This MOU constitutes the entire agreement of the Parties with respect to the 
subject matter hereof, and supersedes any and all other agreements, 
understandings, negotiations, or representations between the Parties with 
respect thereto. 

14. 

Confidentiality 


Each Party agrees to maintain in confidence any Information disclosed to it by, or 
discovered by It regarding, any other Party or Parties it knows or has reason to 
know is proprietary and/or confidential, including, without limitation, the terms of 
this MOU ("Confidential Information"). If the receiving Party becomes legally 
required to disclose Confidential Information, or any part thereof, the receiving 

Party shall give the disclosing Party prompt notice of such requirement. If the 
disclosing Party waives compliance with any of the terms of this Agreement or is 
unable to obtain a protective order or other appropriate remedy with respect to 
such disclosure of Confidential Information, then the receiving Party will disclose 
only that portion of the Confidential Information necessary to ensure compliance 
with such legal requirement. This Section shall survive termination of this MOU. 


[SIGNATURE PAGE FOLLOWS) 
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e Seoreoaliort if any term or condition of this Exhibit I or the application thereof to any 
person(s) or circumstance is held invalid, such invalidity shall not affect other terms or 
conditions which can be given effect without the invalid term or condition; to this end the 
terms Bnd conditions of this Exhibit t are declared severable 

f Survival . Provisions In this Exhibit regarding the use and disclosure of PHI. return or 
destruction of PHI and extensions of the protections of this Exhibit in section (3){Q, shall 
survive the termination of the Agreement. 


IN WITNESS WHEREOF, the parties hereto have duly executed this Exhibit 

Department oWHealth and Human Services Eckerd Youth Alternatives. Inc. d/Wa t Eckerd 
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IN WITNESS WHEREOF, the Parties agree to the expressed terms. 

Eckerd Youth Alternatives, Inc, New Hampshire Division for Children, Youth and 
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Exhibit A: (Sample for info only) 
Client Portal Terms and Conditions 


The following constitutes the terms and conditions under which Mindshare Consulting Group, LLC d/b/a 
Mindshare Technology, {’Mindshare') offers the information, services and facilities of Mindshare. Please 
read the terms and conditions carefully, if you do not agree to any of the terms and conditions you must 
not use the site. 

Client Portal Eligibility & Use 

The Mindshare Portal is only available to Mindshare clients or clients authorized to use the portal by a 
Mindshare authorized provider. To become a user of and have access to the Portal, Mindshare requires 
that you register and provide Mindshare with accurate user Information. 

Acceptable and lawful Use of Site bv Authorized Users 

All users represent and attest that the information they provided when registering as a user and all 
information that they subsequently provide regarding themselves is true and accurate and not 
misleading. 

Use of Site 

You may not use any robot, spider or other automated means to access the Site or content or services 
provided on the Site for any purposes. You may not use any means to index the Site in a search engine. 
You may not post content on the Site that contains any viruses or other computer programming 
routines that are intended to damage or detrimentally Interfere with any system, data or personal 
information. You shall not attempt to make the Site unavailable through denial-of-servicc attacks or 
similar means. 

User Notifications 

If you register as a user, you agree that Mindshare may send information, warning and alert notices, and 
other messages per your preferences, to you via e-mail at the e-mail address you provide when 
registering to become a user (or which you later update). 

User Password and Login Identity 

You are responsible for maintaining the confidentiality of your user password, and user name/login, and 
are fully responsible for all activities that occur under your profile/account with or without your 
knowledge. If you knowingly provide your user name and password Information to another person, your 
user privileges may be suspended temporarily or terminated. You agree to immediately notify 
Mindshare of any unauthorized use of your user password, user name or any other breach of security. 
Ownership and Intellectual Property 

Other than content provided by the Jurisdiction which includes the content presented in the 
dashboards, and other than supplemental review questions that may be configured and updated from 
time to time, Mindshare owns all rights to the intellectual property and material contained in this Site, 
and all such rights are reserved. Payments submitted to Mindshare Is for Hosting and Use of the 
Mindshare Commercial Off the Shelf Software and Services; which includes configurations tailored for 
specific uses that are within the defined parameters of the service and that all aspects of the Host 
Service, including but not limited to the source code, dashboards, analytics and data science are 
proprietary and remain the sole property of Mindshare. 

Mindshare Consulting Group, TACF, ADXt, ICARE, CPRS and Visibility Grid are trademarks of Mindshare 
Consulting Group. All other product and brand names may be trademarks or registered trademarks of 
their respective owners. 

If you disagree with any of the above statements, please contact the system administrator before 
accessing this site. 
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EXHIBIT C 


Health Insurance Portability Act 
Buifncsi Associate Agreement 


£ckerd YotHh AftefnttfrtA, Inc. at EtfcefO KW9 ('Ecwd KdO and Mindchoro 
ConsiAmp (Voup. I LC C^ rnd « hare *) agree to comply win the Heath Insurance FortablNy and 
Accountably Ad. Ruble Law 104-^91 ana wth the Stands? for Privacy and Security of 
intfvidutfly ufcntAabto Healih Infwnraisan, as CFR Pais 180 and 164 and ihaae porta ort tha 
HITECH Aa applicable to txJBineaa awoclataa. Aa dafinad ww. 'Buftnow Aasocaio* shat 
moan gckord Kids and Mindshare and any of 1 heir subconlruc^cfB or agents lhat 
recede, use c r have access to proteclttf hatfm irVcrmabon urwor this Agreement and ‘Covered 
Enw/ snail moan hie Department HtXtii and Human Servces. 


(tj DaliniHons 

a. ‘Breacti* shall nave cne eome m earing as tho lam 'Breach' n soctinn 164 aM ol Title 45 
Coda of Fedaral Regulations 

h ’Breach ftetifLcaliesl Bui*’ shall mean cne provisions of Cno Notification in iho Case of 
Breach oi Unsecured Protected Health Informatson ai 45 CFR Pan 164. Subpan E> and 
amendments thereto 

c n,.«.nflBH AncnnaM' nas the mognng givon such term in section 160 100 of Title 45 
Code erf Federal Regulator* 

d -Cmeteo Entity" has the meaning given ftuclt term In aeoltcn 160.103 Of Title -44. Code of 
Federal Regulator* 

0 noftitmalMi Recaro Set ’ shat nave tho sairo meanng n Ihe term ’Jesiflnaled re«rd 
seT n 45 CFR Section 164 501 

t rh»i« Afvwpnaiiw shell have the BBfflO meaning as tr« term ’Oslo aggregation' in 45 
CFR Section 104 SOI 

g ’ Health Care Operator* * shall have the earns mwneng k me term ’heotn cam 
operations* m 45 CFR Section 164 SOI 

n HITECH Ad* means the HeoHh IrfermaLonTeehnotooy for Economic and Gimcol Hearth 
Act. Title XIII. Sutrtrtlo D Part 1 & 2 of Ihe American Recovery and Reinvestment Act o! 
3009 

i ’K1PAA* means Ihe Hearth Insurance Portebitty and Accountattlily Act ri 1996 Puttie 
LiwiW-191 and ihe Standards for Privacy and Security of IndMduaBy IdanttnaWe HeKtn 
intermaiion 45 CFR Parts 160 162 ano 164 

i ’tndivduar sha3 have Ihe same meaning as the term ’individual* m 46 CFR Section 
160103 and sneC incUdO a person who qualifies as a personal repr«em«rre n 
accordance wtlh 45 CFR Seeron 164 S02(gi 
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4 •P jjvHcv Riie ' sna: rnean ihe Standards for Privacy of Irtdivirijaty identifiable Health 
information at 45 CFR Parle 1 Ed and 164 promuigBied under HIPAA by the Unilod Slaies 
Department of Haedh and Human Service! 

• Prrunr.md Hearth cnformafcnn* shall have the earns meaning u Ihe term ‘prcnecied health 
irfotralion* in 45 CFR Section 150 103. OmHod to the n formation created or received try 
Eki$iws5 Assocale from or on behalf of Covered Entity. 

m - Ronuircd by Law * shat Have Ihft «me meaning as Iha term 'required by W in *5 CFR 
Section 154 103 

n ‘Sejjjgjeji* ahst. naniis Secretary of tno Deportment of HeaDh and Human Services or 
ris/nor designee. 

o *Soci 1 rita_Bi!S‘ sha3 rTjsa " 1 Securny Sianaaros for mo Protacaoi* of Etccdonc 
Prelected Health Informeiion ai 46 CFR Part IM Stbpati C and amendmema thereto. 

0 •imnw.iirnri PrnMcted Health Inter matron' shef have Ihe aame meaning Given such term 
in sedior 1B4 4Q2 of Tide 45. Coda ol Federal Regiuaho'is 

a Other noiii yltone. - AH terms rtol ol ho mu so dafined herein shall have Ihe meaning 
cslabtahed uider 45 C F R Paris 160.102 and 164 dB amondod from lime lo Hite, ano 
the HITECH Asl 

|j) UMJQflDlirffflil iro 0l Prpfrtad H ealth InforttiaKon 

a BuameaB Associate shad non use doebse mami*n or iranamrt Protected haehh 
Information (PHI} except ea reasonably necessary to provide tho services outbied under 
the Agroenrort Further, ihe Business Associate, and its dreclore officers employees 
and agenla. Shell nol use. dStiOBS maintain or Irenjmi PHI n any manner dial would 
corettuto a violation of die Privacy end Security Rub. 

b Busmoss Assocale nay use or disclose PHI 

I For Ihe proper ir-anagoroonl and acnunistrsiwri ct Ihe Business Assocale, 

II As requred by lew pursuer* lo Iha terms set for,h in paragraph o below, or 

III For data aggregation purposes 'or Ihe heanh care ope rat tone of Covered 
€m«y. 

c To Iha extent Busneea Assocrese is permuted under ihe Agreement f IhCAidng tins eufcbn) 
to disclose PHI to a third patty. Businas* Associate must obtain poor la making any such 
declosure (i| reawnabb assurances from the Ihrd baity that such PHI wll be hold 
amfidenlialy and used or further disclosed only as requred by law «■ for Ihe purpose for 
when it was disclosed tb ihe third party, and (III an agreement Iron such iisrd party lo 
nctHy Business Associate, in accordance wth 45 CFR 16o 410, of any breeches of the 
confdenfiaEty ui ihe PHI lo ihe extent II has obtained knmvtedgs of such broach 

d Tne Business Assaoale shell nol disclose any PHI in response to a request far 
disclosure on the bests Ihst rt f rgqurpd by law without ritst nttrtying Covered Enbty ao 
1i*sii Cevpipd Emily has an opporcunty to object to ihe Asdosure ane to sctSt 
eporopnale reket rt Covered Gutty otveds to such raselosure the Business Associate 


HOU - Eckerd Kids, Mlndshare and NH OCYF 
Eckcrd Rapid Safety Feedback 9 


Page \ 






shall ratten Item disclosing ihn PHI until Covered Enllly has etfiBustod all remedies It 
Covered Entity does not object to auch decfesure withip fare (5) business days of Business 
Associate's nolificebcn. ihen Business •Associate may choose to <n8do» tics informabon 
or object as Business Associate deems appropnete 

e H ina Covered Entity notifies the Business Asscoale lhal Coveted Enliiy has agreed to be 
bound by addtonal restrictions over and above Ihose sees or disclosures or secunty 
safeguard of PHI purausm to Ihe Prvacy end Security Rule, the Business Associate shall 
be bound by such additional resintuor.s end shal not disclose PHI in violation of such 
additions! resltlctiohs aid shall BtJKto by any addhonal reasonable security safe guards 

fS) OWtoatlone and Aethrttwia of Business Associate, 


a Too BusncM Associate shell notify Itio Covered E-nbty's Prnracy Otncer without 
uweasorrabte delay end ui no case laser then two (3) business days fallowing the dele 
upon which ihe BuBinees Associate becomes aware of any use cr disclosure of prelected 
health information nol provided for by the Agreement or this Exhbil. ui eluding breaches ot 
unsecured protected health information andtor any security incident that may hove an 
mpact on too protected hcollti mformaikm ci the Covered Enlity. 

b The Business Associate snnl promptly perform a risk araesa/nem When it become* aware 
of any cf Ihe above stluabor* ThO riSf assossment shall include but nol be limited to. tha 
following nfoimsriitxi. » the eidenl C is known by the Business Associate 

• The nature and axiom of ms prciaciod hcatih 'nformstisn involved including the types 
of identifiers and the livelihood Ol re-lflentficalJOn. 

, The unauthoriied person wfio used the protected hcallh infoimaiion or id whom the 

drscOBure wb& made. 

» Whethor tho prelectDd heaiih informallon was ecluetty segu-red or unwed 

• The oatent to wftch the risk to the detected healttl infemtatnn has been irrigated 

The Buttress Associate shall ccraplele the itsk asBeswram w.thout unreasonable delay 
and in no c«e later than two \2> business days cf discovery or Ihe breach anc artier 
comptebon immediately report the findings of the r«k assessment n wiling io the 
Covered Emily 

c The Business Associate shal compty wkh all applicable sectors ol the Privacy, Security, 
and Broach Notification Rule 

d Business Associate shall make Svaleble all of its sntomac policies and pracedures, books 
and records raiolirg to toe use and disclosure or PHI racewed Item cr created or recevec 
by the Business. Associate on behalf of Covered Emily to Ihe Secretory for purposes of 
determining Cowned Entity's comptarce wtlh HIPAA and Ihe Pnvacy and Seeunty Rule 

e Business Associate shall regaira all ef he buBireaa associates 1 M receive, trie or have 
access to PHI under mo Agreonient to agree in writ rig to adhere to toe same resinctiorH 
arw conditions on toe use and disclosure o' PHI oonlamod herein, inducting toe duly to 
return or destroy too PHI as provided under Section 3(l| herein The Covered ErtCy shall 
be considered a direct third patty beneficiary gf lha Contractors fc*jair »99 associate 
agreements wilh Comractor's intended bumees bssocibss who wit bo receiving PKj 
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pw-suarfl lg ttiiB Agree me rti, with rights O' amercement and iPdemnftlcatjon from such 
bu&nes* BflSOtialea who ahafl be governed by the Agreement (or the purpose of Lae and 
disctosuo of protect09 boalth information 


f UVHhTi five (5) business Ays of receipt c t a wrtson requod from Covered Entity, Buenos* 
Associate shall make available dunns normal business houre at -ta office a all records, 
books, agreements, policies and procedures resting to the use and dsdosure cf PHI lg 
me covered Enffiy, for purposes ol ensuing Covered Entity to determina Business 
Avtariate's compliance wilh Ihe terms of this Eahdil. 

g Within ten (IQ) business days of recervng a written request from Covered Erifly, Business 
Assouete shall provide soooss id PH) in 9 Designated Record Sat to the Covered Entity, 
or as directed by Covered Entity, to an individual in oreer to meet ihe requirements under 
45 CFR Section 164 524 

n wemn tsn (10) business dBys of receiving 9 witter* requesl from Covered Entity tor an 
amendment of PHI or a record about an individual contained in a Desgnated Record Set, 
ihe Business Associate shall make such PHI available lo Covered EnMy for amendment 
and incorporate any such amendment to ensbre Covered Entity to futllli lie obtigalions 
under 45 CFR Section 164 529. 

Buaiteaa Associate ahall document such daebaures of PHI and i 11 forma lion related to 
such disclosures as wcub bo required for Covered ErMy to respond lo a request by an 
■ndivlduar tor an accounting ol disclosures ct PHI in accordance with 45 CFR Sedion 
164 528 

Wlhn ten (10) bisness Ays of recewng a wrflen request from Covered Entity for a 
request lor an eccountng ol disclosures of PHI, Business Associate shall make avanatre 
to Covered Emily such information as Covered Entity may require to Mfili its oWigaitens 
to provide an aeccurtng cf disclosures with respect lo PHI m accordance with 45 CFR 
Sector 164 529 

h fnlheevenl any individual requests access lo, amendment of w succoring of PHI d redly 
from Ihe Business Associate Iho Business Associate shall wnfen two (2) busness days 
forward Such request lo Covered Entity Covered EnlHy shafl have the responsbitty el 
responding lo forwarded requests However if forwarding tho ndvi duals requod lo 

Covered Emtly would csubs Covered EnMy or the Business Associate to vioista HIPM 
and Ihe Privacy and Security Rtie, Ihe Business Assoczale shall instead respond to Ihe 
individual's raquosl as required by suA law and notify Covered Entity ol sue* response 
as soon as practicable. 

I. Wffivn ten (ID) business days of temmnabon of the Acroement. tor any reason the 
Business Associate shall return or destroy, as specified by Covered Emily, at PHI 
racervsd from, or crested or received by Ihe Business Associate in connacbor* with Ihe 
Agreement, and shall not retain any copes or back-i*) tapes ol such PKJ. ir mlurn o< 
destruction « not feasible, or Ihe dsposton of ihe PH) has boon otherwise agreed to in 
the Agreement Business Associate shd3 continue lo extend (he protections of this ExhOril, 
to such PHI end Inut further uses and disclosures of such PHi to ffiose purposes lhat 
make the return or de*lructan infeasible, toi so long as Business Associate maintains 
SLich PHI H Covered Emily. in its sole discretion. requires thw the Business AssociBte 
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doseoy any or al PHI. Ihe Buenos* Associate efiail certify to Coveted fcnllty i»ial the phi 
hfi& been destroyed 

W QMIanloita ol Coimrad Entity 

a Coveted Entity sbal' ratify Business Associate of any changes or linvtabotXe} in ite Malice 
Of Privacy Practcss provided Id htflvfcfuals in accordance wl!h 45 CFR Section 154 920 
to the extent that such change or Imitation may a'frci Business Associate's use or 
dlsckasuie or PHI 

b Covered Emily shall promptly noHy Business Associate o# any changes in, or revocation 
ol penruwon crowded to Covered Enbty by individual »hcae PHI may be used or 
dadosed oy Business Aeecoate under ths Agreement. pursuant to 45 CFR Section 
164 509 or 45 CFR Section 164 509 

c Covered petty shal promptly notify Busncss Associate of any restrictions on Ihe use or 
disclosure of PHI that Covered Enllly has agreed to in accordance wtlh 45 CFR 164 532. 
to the oncm mat such rwircikm may affect Business Associate's use or disclosure ol 
PHI 

(S) Tarmlnatton ter Came 

the Covered Entity may immcdale^y terminate the Agreement upon Covered Entity's 
knowledge of a broach by Business Assocarie of tho Business Associate Agreement 
sat loth herein as Exhibit C Tho Covered Enltly may efher urmedaloly terminate Ihe 
Agreement gr provide an opportunity for Business Associate lo cure the alcgotf 
breach vrtlhln a timeframe specified by Covered Entity If Covered Entity deteiminas 
that neither tcimnaton nor cure 4 feasible Covered Entity shall report the vio taken lo 
the Secretary. 

W MiMQlIttMOua 

a Definitions and R eo ufatorv References All terms used, bat not otherwise defned herein, 
shall ham the same meaning as those letme in the Pnvacy and Security Ri/e. ard tho 
HITECH Ad. as codfied al 45 CFR Pa Its 160 and 154 and as amended bom time io time 
A reference in the Agreement as amended to Include this Exhibit, to a Section in Ihe 
Privacy and Security Rule means ihe Section as in effect or bs amended. 

b Am endment Covered Entty and Business Associate agree 10 take such action as is 
neceBBBfY to amend the Agreement, nduding (he Exhibit from lime to tme aa & 
necessary for Covered Ent ty 10 comely with Ihe chengos in me requirements of HIPAA 
mo Privacy and security Rue, and applicable fetters) and state law 

c Data Ownerahto . The Business Associate acknowledges that & has no mwrership rights 
wch respect to iho PHI provided try or created an behalf ol Coveted Entty under ihe 
Agreement 

d interpretation 7he parties agree that any ambiguity in the Agreement or tms Exlubt shall 
be resolved to permit Covered Entity lo comply with HIPAA. Ihe Privacy and Seourky Ruts 
and ihe HITECH Act 
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